19295 matches found
WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability
Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...
PT-2026-78992
Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...
PT-2026-78980
Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...
CVE-2026-73363
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-73363
CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...
EUVD-2026-62383
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
EUVD-2026-62372
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-32552
A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...
WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 contains an unauthenticated data disclosure vulnerability in its REST API authentication logic. The plugin fails to verify that an API consumer secret has actually been generated before comparing it against the value supplied in a reque...
EUVD-2026-62291
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...